topic Re: How do we monitor Disk I/O in Splunk? in Getting Data In

How do we monitor Disk I/O in Splunk?

dwin02 — Fri, 19 Feb 2016 20:53:33 GMT

Hi Splunk Support,

When activating the Performance Monitoring in inputs.conf, I was able to send free disk space to Splunk, but how do I activate monitoring of Disk I/O?

Please advise?

Thanks,
Aldwin

Re: How do we monitor Disk I/O in Splunk?

pgreer_splunk — Tue, 23 Feb 2016 18:41:14 GMT

There is an example configuration stanza for inputs.conf that shows Bytes/sec. Is this what you are looking for (for perfmon in Windows)?

[perfmon://LocalPhysicalDisk]
interval = 0
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = PerfMon

Re: How do we monitor Disk I/O in Splunk?

esix_splunk — Tue, 29 Sep 2020 08:51:55 GMT

The same will hold true for *nix if you are using the Splunk_TA_nix. There is a modular input you can enable...

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

Thats from the default/inputs.conf file. You should copy this to the local/inputs.conf, enable it, and adjust the interval to your desired time polling interval.

Once configured, restart, and search!

Re: How do we monitor Disk I/O in Splunk?

dwin02 — Wed, 24 Feb 2016 01:57:19 GMT

thank you both for your help.
much appreciated!!!